Loxin: A Password-Less Universal Login System - Enabling Bring-Your-Own-Device for Authentication in Enterprise

作为对最终用户进行身份验证的最简单和最便宜的方法，基于密码的身份验证方法一直被组织和企业用作限制和监视访问的默认机制。员工需要记住多个登录凭据，这一事实给企业带来了巨大的成本，因为要求重置密码的帮助台电话越来越多，这使企业面临更多安全漏洞的机会。由于迫切需要一种安全、经济、用户友好的企业认证解决方案，本项目旨在开发一种名为LOXIN的无密码认证系统的原型实现及其威胁和风险评估，该系统可以完全取代现有的基于密码的认证系统，也可以灵活部署，作为双因素认证器，以增强企业环境中的安全性。LOXIN系统通过移动推送消息服务，利用公钥加密技术和移动通道的优势，只需在员工的移动设备上轻敲几下，就可以使用预先拥有的身份对员工进行多种企业服务的认证。此外，LOXIN的一个显著特性是，它消除了在企业应用程序服务器或数据库受到威胁的情况下泄露用户凭据的潜在风险。LOXIN系统将有助于减轻目前企业密码管理实践的痛苦。拟议项目的成功将加强加拿大基础网络系统的安全，并与加拿大的网络安全战略保持一致。拟议的技术向市场的成功转让将给加拿大带来一系列的经济利益。特别是，用户友好且高度安全的认证系统的可用性将为加拿大多个行业部门的云服务提供强有力的保护，并确保加拿大在云安全技术方面的领先地位。

As the easiest and cheapest way of authenticating an end user, password-based authentication methods have been consistently employed by organizations and businesses as the default mechanism of restricting and monitoring access. The fact that employees need to remember multiple login credentials has incurred significant costs for an enterprise due to the increasing number of help desk calls for password reset, is exposing the business to more opportunities for security breaches.Motivated by the urgent need for a secure, cost-effective and user-friendly enterprise authentication solution, the proposed project is to aim for developing a prototype implementation of a password-less authentication system called LOXIN and its threat and risk assessment, which can replace existing password-based authentication systems altogether or can be flexibly deployed to either serve as a two-factor authenticator to enhance security in an enterprise environment. The LOXIN system takes advantage of public-key cryptography and mobile channels by mobile push message services, and authenticates an employee to multiple enterprise services by using pre-owned identities together with few taps on the employee's mobile device. Moreover, one salient feature of LOXIN is that it eliminates the potential risk of leaking users' credentials in the case of enterprise application servers or databases being compromised. The LOXIN system will help relieve the pain for the current enterprise password management practice. The success of the proposed project will strengthen the security of Canada's fundamental cyber systems and aligns well with Canada's Cyber Security Strategy. The successful transfer of the proposed technology to the marketplace will bring a range of economic benefits to Canada. In particular, the availability of the user-friendly and highly secure authentication system will provide strong protection for cloud services in multiple industry sectors in Canada and ensure Canada's position in the forefront of cloud security technologies.